fix(manifest): default sbt pom output to pom.xml for scan discovery

Match the gradle init script's convention by writing the sbt-generated
manifest as pom.xml at the project root above target/, so Socket scan's
**/pom.xml glob picks it up automatically. Help text documents --out as
the escape hatch when a hand-authored pom.xml exists at the root.

Author: jfblaa

CHANGELOG.md

@@ -7,7 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [1.1.94](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.94) - 2026-05-12
 
 ### Fixed
-- `socket manifest scala` now copies sbt-generated `.pom` files out of each subproject's `target/` directory to the project root, so downstream SBOM and scan steps that respect `.gitignore` can see the generated manifest files.
+- `socket manifest scala` now copies sbt-generated `.pom` files out of each subproject's `target/` directory to the project root as `pom.xml`, so Socket scan (which discovers `**/pom.xml` and respects `.gitignore`) picks them up automatically. Use `--out` to override the destination filename.
 
 ## [1.1.93](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.93) - 2026-05-08
 

src/commands/manifest/cmd-manifest-scala.mts

@@ -59,8 +59,10 @@ const config: CliCommandConfig = {
 
     There are some caveats with \`build.sbt\` to \`pom.xml\` conversion:
 
-    - the xml is exported as socket.pom.xml as to not confuse existing build tools
-      but it will first hit your /target/sbt<version> folder (as a different name)
+    - the xml is exported as pom.xml at the project root so Socket scan picks
+      it up; sbt itself first writes it inside your /target/sbt<version> folder
+      (as a different name). Use --out to override if you already have a
+      hand-authored pom.xml at the project root.
 
     - the pom.xml format (standard by Scala) does not support certain sbt features
       - \`excludeAll()\`, \`dependencyOverrides\`, \`force()\`, \`relativePath\`
@@ -148,7 +150,7 @@ async function run(
       out = sockJson.defaults?.manifest?.sbt?.outfile
       logger.info(`Using default --out from ${SOCKET_JSON}:`, out)
     } else {
-      out = './socket.pom.xml'
+      out = './pom.xml'
     }
   }
   if (!sbtOpts) {

src/commands/manifest/cmd-manifest-scala.test.mts

@@ -35,8 +35,10 @@ describe('socket manifest scala', async () => {
 
           There are some caveats with \`build.sbt\` to \`pom.xml\` conversion:
 
-          - the xml is exported as socket.pom.xml as to not confuse existing build tools
-            but it will first hit your /target/sbt<version> folder (as a different name)
+          - the xml is exported as pom.xml at the project root so Socket scan picks
+            it up; sbt itself first writes it inside your /target/sbt<version> folder
+            (as a different name). Use --out to override if you already have a
+            hand-authored pom.xml at the project root.
 
           - the pom.xml format (standard by Scala) does not support certain sbt features
             - \`excludeAll()\`, \`dependencyOverrides\`, \`force()\`, \`relativePath\`

src/commands/manifest/convert_sbt_to_maven.mts

@@ -116,7 +116,7 @@ export async function convertSbtToMaven({
       // typically gitignored. Copy them out to a sibling of `target/` so
       // downstream SBOM/scan steps see them.
       const copied: string[] = []
-      const outBasename = path.basename(out) || 'socket.pom.xml'
+      const outBasename = path.basename(out) || 'pom.xml'
       for (const pomPath of poms) {
         let destPath: string
         if (poms.length === 1 && out !== outBasename) {

src/commands/manifest/generate_auto_manifest.mts

@@ -34,7 +34,7 @@ export async function generateAutoManifest({
       // Note: `sbt` is more likely to be resolved against PATH env
       bin: sockJson.defaults?.manifest?.sbt?.bin ?? 'sbt',
       cwd,
-      out: sockJson.defaults?.manifest?.sbt?.outfile ?? './socket.sbt.pom.xml',
+      out: sockJson.defaults?.manifest?.sbt?.outfile ?? './pom.xml',
       sbtOpts:
         sockJson.defaults?.manifest?.sbt?.sbtOpts
           ?.split(' ')